Research map / Large language models / Language, safety and interpretability
SRDC: Semantics-based Ransomware Detection and Classification with LLM-assisted Pre-training
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SRDC, which semantically rewrites dynamic ransomware features and continues pre-training GPT-2 on an expert- and LLM-curated ransomware corpus (LATAP) to improve family classification and zero-day ransomware detection.
Problem
Dynamic-feature ransomware detection and family classification do not exploit the semantics inside feature names or external ransomware knowledge, and they depend heavily on labeled data, which generalizes poorly to zero-day ransomware.
Approach
Rewrite API/registry/file feature names into natural-language verb phrases, then run task-adaptive pre-training of GPT-2 on an external corpus of Windows API/registry descriptions and ransomware reports (partly generated by an LLM and checked by experts), followed by hierarchical per-feature-type encoding and a classifier.
Key results
- SRDC reaches 54.83% balanced accuracy on ransomware family classification versus 50.25% for BERT and 48.89% for VarLenPSO.
- On zero-day detection SRDC gets 0.96 accuracy and 0.96 F1 versus 0.93 and 0.92 for DCAE-ZSLHVE; with only two seen families the F1 stays above 90%.
- LATAP lowers perplexity of SRDC-GPT by 18.6% on average versus GPT-2 on unseen ransomware features.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use SRDC instead of BERT | Ransomware family classification · Ransomware family classification | balanced accuracy (%): 50.25 -> 54.83 | Helped |
| Use SRDC instead of DCAE-ZSLHVE | Zero-day ransomware detection · Zero-day ransomware detection | F1-score: 0.92 -> 0.96 | Helped |
| Add LATAP pre-training | GPT-2 for zero-day ransomware detection · Zero-day ransomware detection | recall: 0.94 -> 0.97 | Helped |
| Add LATAP pre-training | GPT-2 language model · Dynamic features across the dataset | average perplexity: 5.0082 -> 4.0765 | Helped |
| Add LATAP pre-training | SRDC-GPT few-shot zero-day ransomware detection · Three seen ransomware families | F1-score: 7.03% | Helped |
| Add feature internal semantic processing (ablation) | SRDC · Ransomware family classification | balanced-acc: 0.529 -> 0.548 | Helped |
| Add feature internal semantic processing (ablation) | SRDC · Zero-day ransomware detection | F1-score: 0.908 -> 0.956 | Helped |
| Add feature extraction compressor (ablation) | SRDC · Ransomware family classification | balanced-acc: 0.528 -> 0.548 | Helped |
| Add feature extraction compressor (ablation) | SRDC · Zero-day ransomware detection | F1-score: 0.922 -> 0.956 | Helped |
| Use separate feature modeling instead of concatenating all features (ablation) | SRDC · Ransomware family classification | balanced-acc: 0.439 -> 0.548 | Helped |
| Use separate feature modeling instead of concatenating all features (ablation) | SRDC · Zero-day ransomware detection | F1-score: 0.896 -> 0.956 | Helped |
Surprising findings
- Using only two seen ransomware families for training still yields above 90% F1 on unseen families, a sizable few-shot result.
Limitations
- Small dataset (582 ransomware, 942 goodware samples) with very rare families such as PGPCODER (4 samples).
- Many misclassifications stem from insufficient features in samples.
- Pre-training corpus is 88% LLM-generated and only 1.8% of it was found irrelevant or incorrect by experts.
Experimental setup
Datasets: Sgandurra et al. 2016 ransomware dynamic features dataset Windows system API descriptions Windows system registry descriptions ransomware analysis reports
Benchmarks: Sgandurra et al. 2016 ransomware dataset
Metrics: balanced accuracy accuracy recall F1-score perplexity
Baselines: VarLenPSO KNN LSTM BERT SVM GoogleNet Inception V3 ResNet50 DCAE-ZSLHVE GPT-2
Builds on: GPT-2 task-adaptive pre-training VarLenPSO DCAE-ZSLHVE
Closest papers by meaning
- T-NET: Weakly Supervised Graph Learning for Combatting Human Trafficking (AAAI 2024 · similarity 0.81)
- MTVHunter: Smart Contracts Vulnerability Detection Based on Multi-Teacher Knowledge Translation (AAAI 2025 · similarity 0.80)
- Virus Infection Attack on LLMs: Your Poisoning Can Spread "VIA" Synthetic Data (NeurIPS 2025 · similarity 0.80)
- Lie Detector: Unified Backdoor Detection via Cross-Examination Framework (NeurIPS 2025 · similarity 0.80)
- Towards Surveillance Video-and-Language Understanding: New Dataset Baselines and Challenges (CVPR 2024 · similarity 0.80)
- DRSM: De-Randomized Smoothing on Malware Classifier Providing Certified Robustness (ICLR 2024 · similarity 0.79)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.